diff --git a/src/cargo/ops/registry.rs b/src/cargo/ops/registry.rs
index be8f1077d37..c819c6e5ba9 100644
--- a/src/cargo/ops/registry.rs
+++ b/src/cargo/ops/registry.rs
@@ -764,7 +764,7 @@ pub fn registry_login(
                 .with_context(|| "failed to read stdin")?;
             // Automatically remove `cargo login` from an inputted token to
             // allow direct pastes from `registry.host()`/me.
-            line.replace("cargo login", "").trim().to_string();
+            line = line.replace("cargo login", "").trim().to_string();
             if line.is_empty() {
                 bail!("please provide a non-empty token");
             }
diff --git a/tests/testsuite/login.rs b/tests/testsuite/login.rs
index 716bc3e41b4..f5a5d94c417 100644
--- a/tests/testsuite/login.rs
+++ b/tests/testsuite/login.rs
@@ -90,3 +90,21 @@ fn registry_credentials() {
     assert!(check_token(TOKEN, Some(reg)));
     assert!(check_token(TOKEN2, Some(reg2)));
 }
+
+#[cargo_test]
+fn empty_login_token() {
+    let _registry = RegistryBuilder::new().build();
+    setup_new_credentials();
+
+    cargo_process("login")
+        .with_stdout("please paste the API Token found on [..]/me below")
+        .with_stdin("\t\n")
+        .with_stderr(
+            "\
+[UPDATING] `dummy-registry` index
+[ERROR] please provide a non-empty token
+",
+        )
+        .with_status(101)
+        .run()
+}